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Why GAO Did This Study 

The anthrax attacks of 2001 and more 
recent national reports have raised 
concerns that the United States is 
vulnerable to attacks with chemical, 
biological, radiological, and nuclear 
(CBRN) agents. Because of the 
potential consequences of such 
attacks, members of Congress have 
expressed the need for the 
Departments of Homeland Security 
(DHS) and Health and Human 
Services (HHS) to coordinate in 
assessing risks posed by CBRN 
agents. GAO was asked to examine 
how DHS and HHS coordinate on the 
development of CBRN risk 
assessments and the extent to which 
they have institutionalized such 
efforts. GAO examined relevant laws, 
presidential directives, collaboration 
best practices, and internal control 
standards; analyzed DHS and HHS 
CBRN risk assessments; and 
interviewed DHS and HHS officials. 

What GAO Recommends 

GAO recommends that DHS establish 
time frames and milestones to better 
ensure timely development and 
interagency agreement on written 
procedures for development of DHS's 
CBRN risk assessments and that HHS 
develop written procedures for 
obtaining and incorporating 
interagency input into its modeling 
reports and determine whether to 
renew its interagency agreement. 
DHS and HHS generally agreed. HHS 
expressed concern that the report 
implied it does not vet its products 
through its interagency partners, but 
GAO believes that it appropriately 
credited HHS with having a process 
to do so in the report. 

View GAO-1 1-606 or key components. 
For more information, contact William O. 
Jenkins, Jr. at (202) 512-8777 or 
jenkinswo@gao.gov or Marcia Crosse at (202) 
512-71 14 or crossem@gao.gov. 



What GAO Found 

DHS and HHS have coordinated with each other and with other federal 
departments to develop CBRN risk assessments, but neither department has 
written procedures for developing these assessments. GAO's best practices 
for interagency collaboration and federal standards for internal control 
indicate that agencies can best enhance and sustain coordination by adopting 
key practices, such as defining desired common outcomes, agreeing on roles 
and responsibilities, and developing written policies and procedures to help 
ensure that management directives are enforced. Such practices and 
standards could help DHS and HHS institutionalize their agreements on these 
sensitive and technical issues to better ensure coordination, collaboration, 
and continuity beyond the tenure of any given official or individual office. 

• DHS develops two types of CBRN risk assessments — terrorism risk 
assessments (TRA) and material threat assessments (MTA). TRAs assess 
the relative risks posed by multiple CBRN agents based on variable 
threats, vulnerabilities, and consequences. MTAs assess the threat posed 
by given CBRN agents or classes of agents and potential human exposures 
in plausible, high-consequence scenarios. DHS develops TRAs through 
interagency workgroups and has developed some MTAs in this way, which 
allow partners, such as HHS and the Department of Defense, to assess risk 
models and review and comment on the assessments. However, DHS does 
not have interagency agreements or written procedures for TRA and MTA 
development. In addition, DHS's processes and coordination with HHS for 
MTA development have varied, and HHS officials would like to be more 
involved. DHS officials told GAO they intend to develop procedures 
through interagency agreements with federal partners by June 2012 but 
have not yet established interim time frames or milestones for doing so. 
By establishing interim time frames and milestones for developing and 
obtaining interagency agreement on its CBRN risk assessments, DHS 
could better ensure that it completes its plans in the intended time frame. 

• HHS develops one type of CBRN risk assessment — modeling the public 
health consequences of attacks using information from DHS MTAs — 
through an interagency body that includes DHS and other departments, 
such as the Departments of Defense and Veterans Affairs. HHS signed an 
interagency agreement and charters with these partners, consistent with 
interagency coordination best practices. However, HHS does not have 
written procedures detailing the processes for developing the modeling 
reports, such as when and how its partners are to provide input and 
review and comment on the overall report. Written procedures for 
development and review of the modeling reports could provide HHS with 
standardized direction for obtaining, evaluating, and incorporating 
interagency input. In addition, the interagency agreement expires in June 
2011, and HHS officials were not certain whether they would renew it 
based on ongoing revisions to the interagency charters. Renewing the 
interagency agreement or determining if the revised charters sufficiently 
outline key practices for working across agency boundaries could help 
ensure participating departments' commitment to work collaboratively. 
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Abbreviations 



BTRA 


biological terrorism risk assessment 


CBRN 


chemical, biological, radiological, and nuclear 


CTRA 


chemical terrorism risk assessment 


DHS 


Department of Homeland Security 


HHS 


Department of Health and Human Services 


HSPD 


Homeland Security Presidential Directive 


ITRA 


integrated CBRN terrorism risk assessment 


MOU 


memorandum of understanding 


MTA 


material threat assessment 


PHEMCE 


Public Health Emergency Medical Countermeasures 




Enterprise 


R/NTRA 


radiological and nuclear terrorism risk assessment 


TRA 


terrorism risk assessment 
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June 21, 2011 

The Honorable Joseph I. Lieberman 
Chairman 

The Honorable Susan M. Collins 
Ranking Member 

Committee on Homeland Security and Governmental Affairs 
United States Senate 

The anthrax attacks of 2001 raised concerns that the United States is 
vulnerable to threats from chemical, biological, radiological, and nuclear 
(CBRN) agents, and the 2007 National Strategy for Homeland Security 
stated that terrorists have declared their intention to acquire and use 
CBRN agents as weapons to inflict catastrophic attacks against the United 
States. 1 More recently, the May 2010 National Security Strategy noted that 
the American people face no greater or more urgent danger than a 
terrorist attack with a nuclear weapon, as well as the concern that the 
effective dissemination of a lethal biological agent within a U.S. city would 
endanger the lives of hundreds of thousands of people and have 
unprecedented economic, societal, and political consequences. 2 In 
addition, multiple groups have assessed the federal government's ability to 
protect the nation from CBRN agents and deemed it inadequate. For 
example, in January 2010, the congressionally mandated Commission on 
the Prevention of Weapons of Mass Destruction Proliferation and 
Terrorism reported that the federal government lacked the capability to 
rapidly recognize, respond to, and recover from a terrorist attack using 
biological agents. 

Because CBRN agents differ in their potential to be used to cause 
widespread illness and death, members of Congress have expressed the 
need for the Departments of Homeland Security (DHS) and Health and 
Human Services (HHS) to assess the risks posed by CBRN agents in order 
to identify the highest-risk agents, and use their assessments to guide 
development of response capabilities. Response capabilities include 
medical countermeasures such as drugs, vaccines, and devices to 
diagnose, treat, prevent, or mitigate the potential effects of exposure to 
these agents, and CBRN surveillance and detection equipment. Assessing 



'White House, National Strategy for Homeland Security (Washington, D.C., October 2007). 
2 White House, National Security Strategy (Washington, D.C., May 2010). 
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the risks posed by CBRN agents requires analyzing and modeling areas of 
great uncertainty, including determining an adversary's capability to 
acquire these agents, develop them into weapons, and disseminate them to 
estimate the plausibility and consequences of such attacks. In order to 
prepare for and respond to potential attacks, effective assessment of the 
risks posed by CBRN agents to national security and public health requires 
successful and sustained coordination and collaboration between DHS, 
HHS, and other federal departments and agencies with responsibilities and 
expertise in this area. 3 Federal agencies can enhance and sustain their 
collaboration on CBRN risk assessment efforts by engaging in key 
practices — including agreeing on roles, responsibilities, processes, and 
outcomes — and by establishing this collaboration in written agreements. 
Institutionalizing this information in writing can better ensure that these 
agreements continue beyond the tenure of any given agency official, 
enabling future officials to know how they should develop CBRN risk 
assessments collaboratively with their partner agencies. 

You asked us to examine interagency coordination between DHS and HHS 
for the development of their CBRN risk assessments. This report 
addresses how DHS and HHS coordinate on the development of CBRN 
risk assessments and the extent to which they have institutionalized such 
efforts through interagency agreements and written procedures. 

To determine how DHS and HHS coordinate on the development of CBRN 
risk assessments and the extent to which they have institutionalized such 
efforts, we reviewed relevant federal laws, presidential directives, 
executive orders, and national strategies. We reviewed these documents to 
identify requirements for DHS and HHS to develop and engage in 
interagency coordination during the development of their CBRN risk 
assessments and compared these requirements against DHS's and HHS's 
efforts. We obtained and reviewed the CBRN risk assessments DHS and 
HHS developed since 2004, the year initial legislative requirements were 
enacted for the departments to develop these assessments, to determine 
how these documents were developed and to identify DHS's and HHS's 
processes for their development. We examined coordination between DHS 
and HHS for the development of CBRN risk assessments and did not 
examine the coordination between other federal departments since DHS 
and HHS have primary responsibility for conducting and overseeing CBRN 



Collaboration can be broadly defined as any joint activity that is intended to produce more 
public value than could be produced when organizations act alone. 
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risk assessment activities. For the purposes of this report, we consider 
CBRN risk assessments to include DHS's terrorism risk assessments 
(TRA) and material threat assessments (MTA) and HHS's public health and 
medical consequence modeling reports. TRAs assess the risks posed by 
CBRN agents based on variable threats, vulnerabilities, and 
consequences. 4 MTAs assess the threat posed by given CBRN agents and 
the potential number of human exposures in plausible high-consequence 
scenarios. Modeling reports assess the public health and medical 
consequences of attacks with CBRN agents for given scenarios. (See app. I 
for more information on the TRAs, MTAs, and modeling reports.) We 
reviewed our best practices to enhance and sustain agency collaboration, 
as well as Standards for Internal Control in the Federal Government, for 
guidelines on internal controls — an integral component of an 
organization's management that provides reasonable assurance that 
objectives including effectiveness and efficiency of operations are being 
achieved — and the Project Management Institute's Standard for Program 
Management for program management best practices. 5 We compared 
these practices and standards to DHS's and HHS's CBRN risk assessment 
development activities and related documents. We also interviewed 
officials from multiple DHS and HHS offices, components, and agencies — 
including DHS's Science and Technology Directorate and HHS's Office of 
the Assistant Secretary for Preparedness and Response — to obtain 
information on their interagency coordination processes for CBRN risk 
assessment development. 



4 According to the DHS Risk Lexicon, threats are entities, actions, or occurrences, whether 
natural or man-made, that have or indicate the potential to harm life, information, 
operations, and/or property; vulnerabilities are physical features or operational attributes 
that render an entity, asset, system, network, or geographic area susceptible or exposed to 
hazards; and consequences are potential or actual effects of an event, incident, or 
occurrence. DHS, DHS Risk Lexicon: 2010 Edition (Washington, D.C., September 2010). 

D GAO, Results-Oriented Government: Practices That Can Help Enhance and Sustain 
Collaboration among Federal Agencies, GAO-06-15 (Washington, D.C.: Oct. 21, 2005); GAO, 
Standards for Internal Control in the Federal Government, GAO/AIMD-00-21.3.1 
(Washington, D.C.: November 1999); and Project Management Institute, The Standard for 
Program Management, 2nd ed. (Newton Square, Pa., 2008). The criteria in GAO/AIMD 00- 
21.3.1, dated November 1999, issued pursuant to the requirements of the Federal Managers' 
Financial Integrity Act of 1982 (FMFIA), provide the overall framework for establishing and 
maintaining internal control in the federal government. Also pursuant to FMFIA, the Office 
of Management and Budget issued Circular A-123, revised December 21, 2004, to provide 
the specific requirements for assessing the reporting on internal controls. Internal control 
standards and the definition of internal control in Circular A-123 are based on GAO's 
Standards for Internal Control in the Federal Government. See also the Related GAO 
Products section at the end of this report. 
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We conducted this performance audit from January 2011 through June 
2011 in accordance with generally accepted government auditing 
standards. Those standards require that we plan and perform the audit to 
obtain sufficient, appropriate evidence to provide a reasonable basis for 
our findings and conclusions based on our audit objectives. We believe 
that the evidence obtained provides a reasonable basis for our findings 
and conclusions based on our audit objectives. 



Background. DHS leads federal interagency coordination and planning for emergency 

" response to catastrophic CBRN incidents in the United States. DHS is 

responsible for assessing the risks posed by various CBRN agents, as 
directed by the Project BioShield Act of 2004 6 and Homeland Security 
Presidential Directives (HSPD) 10 (Biodefense for the 21st Century), 18 
(Medical Countermeasures against Weapons of Mass Destruction), and 22 
(National Domestic Chemical Defense). To this end, DHS's Science and 
Technology Directorate develops CBRN TRAs and MTAs. 



• Each TRA assesses the relative risks posed by multiple CBRN agents 
based on variable threats, vulnerabilities, and consequences. Since 2004, 
DHS has developed seven TRA reports, with additional TRAs to be 
published in 2011. 

• Each MTA assesses the threat posed by a given, individual CBRN agent or 
class of agents and the potential number of human exposures in plausible, 
high-consequence scenarios. Since 2004, DHS has developed 17 MTA 
reports. 

DHS uses the MTAs to determine which CBRN agents pose a material 
threat sufficient to affect national security. 7 (See app. I for more 
information on DHS's TRAs and MTAs.) 



6 42 U.S.C. § 247d-6b(c)(2)(A). 

'Since 2004, DHS determined that 14 of 17 CBRN agents that it assessed in MTAs pose a 
material threat to the nation and issued material threat determinations for those agents. 
The 14 material threat determinations that DHS has issued to date are for Bacillus 
anthracis (anthrax), Burkholderia mallei (glanders), Burkholderia pseudomallei 
(melioidosis), Clostridium botulinum (botulism toxin), Ebola virus (hemorrhagic fever), 
Francisella tularensis (tularemia), Junin virus (hemorrhagic fever), Marburg virus 
(hemorrhagic fever), multidrug-resistant Bacillus anthracis (MDR anthrax), Rickettsia 
prowazekii (typhus), Variola major (smallpox), Yersinia pestis (plague), radiological 
agents, and nuclear agents. 
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HHS leads the federal public health and medical response to potential 
CBRN incidents. Under the Project BioShield Act, HHS is required to 
assess, on an ongoing basis, the potential public health consequences of 
those CBRN agents that DHS determines pose a material threat sufficient 
to affect national security. This law requires HHS to determine for which 
of these agents medical countermeasures are necessary to protect the 
public's health. 8 HHS conducts these activities through the Public Health 
Emergency Medical Countermeasures Enterprise (PHEMCE), a federal 
interagency decision-making body HHS established in 2006. 9 Officials from 
HHS, 10 DHS, 11 the Department of Defense, 12 the Department of Veterans 
Affairs, the Department of Agriculture, and the Executive Office of the 
President participate in the PHEMCE working groups and senior council. 
The PHEMCE working groups and senior council serve as the primary 
means of communication between these federal departments on CBRN 
medical countermeasure issues. As part of their activities, PHEMCE 
working group members develop medical consequence modeling reports 
to help assess the potential public health and medical consequences of 
attacks with given CBRN agents, which is an interim step in determining 
what types and quantities of medical countermeasures may be required to 
respond. Since 2004, HHS has issued 19 modeling reports for various 



8 42 U.S.C. § 247d-6b(c)(2)(B). The Project BioShield Act authorizes the federal government 
to use specific contracting authorities to procure certain medical countermeasures for 
these agents and established the Project BioShield Special Reserve Fund for the acquisition 
of certain medical countermeasures, some of which may not yet qualify for approval or 
licensing. 

9 PHEMCE is responsible for providing recommendations to the Secretary of Health and 
Human Services on (1) prioritized requirements for CBRN medical countermeasures, 
(2) coordination of medical countermeasure development and acquisition activities to 
address the requirements, and (3) strategies for distributing medical countermeasures held 
in national stockpiles. In addition to these responsibilities, PHEMCE is also responsible for 
countermeasures for pandemic influenza and other emerging infectious diseases. 

10 HHS officials from the Centers for Disease Control and Prevention, the Food and Drug 
Administration, the National Institutes of Health, and the Office of the Assistant Secretary 
for Preparedness and Response participate in PHEMCE, in addition to officials from other 
HHS offices. 

H DHS officials from DHS's Science and Technology Directorate and Office of Health 
Affairs participate in PHEMCE. 

12 The Department of Defense has exclusive responsibility for research, development, 
acquisition, and deployment of medical countermeasures to prevent or mitigate the health 
effects of CBRN agents and naturally occurring diseases on armed forces personnel. Under 
the PHEMCE structure, the Department of Defense also coordinates with HHS to share 
information and resources for common CBRN medical countermeasure priorities to reduce 
duplication of effort. 
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CBRN agents. HHS develops modeling reports using data from DHS's 
MTAs, such as the number of individuals exposed to a given agent, to 
calculate the number of individuals who may become ill, be hospitalized, 
or die based on the MTA scenarios. (See app. I for more information on 
HHS's modeling reports.) 



DHS and HHS 
Coordinate on the 
Development of 
CBRN Risk 
Assessments but Do 
Not Have Written 
Procedures for Their 
Development 



DHS and HHS have coordinated with each other and with other federal 
departments for the development of CBRN risk assessments, but neither 
has written procedures for developing these assessments. Such written 
procedures are important for enhancing and sustaining collaboration 
because they can help ensure that the departments institutionalize 
agreements on their respective roles and responsibilities, processes for 
developing the risk assessments, and desired outcomes. DHS and HHS 
officials are currently discussing DHS's processes for developing CBRN 
risk assessments because HHS officials said that they are concerned that 
they have not been consistently involved early or substantively enough in 
the process. DHS officials told us they intend to develop written 
procedures through interagency agreements with federal partners by June 
2012, but DHS has not yet established interim time frames and milestones 
as part of a plan to ensure that it accomplishes these results by that time. 
HHS has signed a memorandum of understanding (MOU) and working 
group charters with DHS and other federal partners that participate in 
PHEMCE, but the department does not have written procedures that detail 
the interagency processes that PHEMCE working group members are to 
use to develop modeling reports. Also, agency officials were not certain 
whether HHS will renew the MOU, which expires in June 2011, based on 
ongoing revisions to the working group charters. 
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DHS Coordination with 
HHS on the Development 
ofltsCBRNRisk 
Assessments Has Varied, 
and DHS Has Not Yet 
Established Related 
Written Procedures 



Starting with the first biological terrorism risk assessment (BTRA) in 2006, 
DHS coordinated with HHS and other federal partners prior to issuing the 
TRAs. 13 For the 2006 BTRA, DHS consulted with interagency experts via 
an ad hoc process to solicit their input during the development of the risk 
assessment or to have them comment on the draft document. DHS did not 
have interagency agreements or written procedures to articulate roles, 
responsibilities, or processes for interagency development or review of the 
risk assessment. In addition, DHS did not have interagency working 
groups or other structures to regularly solicit and receive partner input. 
For example, according to HHS officials, DHS did not involve HHS as the 
2006 BTRA was being developed but did ask HHS to comment on it after it 
was drafted. According to DHS officials, working groups were not 
established for the 2006 BTRA because of the limited time that DHS had to 
complete this task. 

Since the 2006 BTRA, interagency coordination for the development and 
review of the TRAs has become more structured and been strengthened, 
according to DHS officials. This strengthening of coordination was based 
in part on feedback received from its interagency partners. For example, 
DHS officials said that HHS officials wanted to be consistently involved 
earlier in the development of the TRAs to be able to raise issues prior to 
reviewing the draft reports. DHS established two types of federal 
interagency working groups designed to increase the structure for 
obtaining interagency input on developing and reviewing TRAs. 14 First, 
DHS established a working group for each TRA composed of CBRN 
experts from a variety of federal agencies, including HHS. For example, 
the integrated CBRN terrorism risk assessment (ITRA) working group 
includes officials from HHS's Office of the Assistant Secretary for 
Preparedness and Response and the National Institutes of Health. These 
working groups meet monthly to quarterly on an ongoing basis and 
provide a forum for members to (1) assess TRA modeling results, 
(2) request specialized studies to be included, and (3) review and 



1 DHS develops its TRAs by integrating information from the intelligence and law 
enforcement communities, as well as input from the scientific, medical, and public health 
communities, among others. 

14 In addition to HHS, members of the TRA working groups include the Department of 
Defense, the Environmental Protection Agency, and the Nuclear Regulatory Commission, 
among others. 
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comment on draft TRA reports. 15 Second, DHS established a working 
group composed of experts from the intelligence community so DHS can 
obtain their input into and review of threat analysis data for the TRAs. 
According to DHS officials, this working group meets on an as-needed 
basis. 

DHS does not have interagency agreements or written procedures to 
define the process for how the TRAs should be developed with DHS's 
interagency partners, the products that should be produced, or the roles 
and responsibilities of involved agencies. Not having agreements and 
procedures is not consistent with our best practices for interagency 
collaboration and federal standards for internal control. According to our 
best practices, federal agencies engaged in interagency coordination can 
enhance and sustain their collaboration by adopting key practices — 
including defining and articulating a common outcome, agreeing on roles 
and responsibilities, and establishing compatible policies and procedures 
for operating across agency boundaries. In addition, agencies can 
strengthen their commitment to work collaboratively by articulating their 
agreements on these key practices in documents, such as MOUs or 
interagency planning documents, signed by senior officials in the 
respective agencies. 16 Further, federal standards for internal control call 
for agencies to develop written policies and procedures that enforce 
management's directives. 17 

DHS officials stated that interagency coordination to date has relied on the 
personal relationships established by involved officials, and that DHS was 
not required to develop interagency agreements or written procedures. 
However, DHS officials agree that such interagency agreements and 
written procedures should be developed, and they plan to develop them by 



15 DHS convenes separate working groups for each of the TRAs that DHS produces. Each 
working group is responsible for development and review of its respective TRA, in 
conjunction with the contractors that DHS utilizes to develop TRA data inputs and perform 
related mathematical modeling. Separate working groups exist for the BTRA, the chemical 
TRA (CTRA), the radiological and nuclear TRA (R/NTRA), and the ITRA. 

16 See GAO-06-15. Additional key practices include establishing mutually reinforcing or joint 
strategies to achieve the outcome; identifying and addressing needs by leveraging 
resources; developing mechanisms to monitor, evaluate, and report the results of 
collaborative efforts; reinforcing agency accountability for collaborative efforts through 
agency plans and reports; and reinforcing individual accountability for collaborative efforts 
through agency performance management systems. 

17 See GAO/AIMD-00-21.3.1. 
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June 2012, as directed by the Chief Medical and Science Advisor in the 
Chemical and Biological Division of DHS's Science and Technology 
Directorate in early 20 11. 18 

DHS began an effort to develop written policies and procedures for the 
TRA working groups at the end of 2010. Specifically, DHS drafted a charter 
for the working group that developed the 2011 ITRA, and DHS officials 
told us in October 2010 that they planned to do the same for the three 
other TRA working groups by the end of fiscal year 2011. However, as of 
March 2011, DHS officials said they had ended their efforts to finalize the 
ITRA charter and develop charters for the other working groups. 

DHS officials told us that they have begun drafting a strategic plan for 
DHS's overall CBRN risk assessment efforts and implementation plans for 
each of the TRAs and for the MTAs. The strategic and implementation 
plans, according to DHS officials, will contain written procedures to define 
TRA and MTA (1) interagency development processes, (2) products, and 
(3) roles and responsibilities for involved agencies. In addition, DHS 
officials said they will seek to have these plans signed by senior leaders at 
each of DHS's partner agencies to demonstrate interagency agreement on 
these procedures. DHS officials emphasized the importance of having their 
partners sign the documents to establish their commitment to working 
collaboratively on DHS's CBRN risk assessments based on the agreements 
articulated within the plans. At the time of our review, DHS did not have 
documentation available for us to review related to this initiative. HHS 
officials said that they had not seen the draft plans and were not in a 
position to agree or disagree with DHS's approach but have told DHS they 
would like to collaborate on this effort. 

DHS has not yet developed interim time frames and milestones as part of a 
plan — consistent with standard practices for program management — to 
develop, finalize, and obtain interagency agreement on the proposed 
strategic and implementation plans. 19 According to DHS officials, such 
milestones include drafting the strategic and implementation plans with 
input from DHS's interagency partners, obtaining approval from DHS 



The Chemical and Biological Division in DHS's Science and Technology Directorate is the 
DHS entity responsible for the development of the TRAs and MTAs. 

19 The Project Management Institute, The Standard for Program Management. The 
Standard for Program Management calls for establishing time frames and milestones as 
part of a plan to ensure that intended results are achieved. 
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senior management and general counsel to distribute the drafts, receiving 
and incorporating any changes requested by the partners, and obtaining 
interagency signatures on the final documents to institutionalize the 
interagency agreements. The Chief Medical and Science Advisor in the 
Chemical and Biological Division of DHS's Science and Technology 
Directorate initially told us in March 2011 that DHS planned to complete 
this effort by the end of September 2011, but has since extended this 
estimated completion date to June 2012. Establishing interim time frames 
would identify targeted dates for completing these milestone activities, 
among others, by June 2012. 

DHS's coordination with HHS and other agencies, as well as its processes 
for developing MTAs, have varied. Based on our analysis of DHS's 
processes for developing 17 MTAs from 2004 to 2010, DHS used at least 
four different processes for interagency coordination. For most of the 
MTAs, DHS held a preliminary discussion with HHS on the need for a new 
MTA, as well as the scope and scenario to be assessed. In some of these 
cases, DHS followed the preliminary discussion with HHS by convening 
two interagency workshops, one to solicit input on the proposed approach 
to developing the MTA and the other to solicit interagency comments on 
the MTA once it was drafted. However, in other cases, DHS only held the 
preliminary discussion with HHS and the later workshop to review the 
draft document. For one MTA, DHS did not hold a preliminary discussion 
with HHS or convene any workshops during its development. 

A DHS official involved with the MTA coordination process said that while 
DHS had defined a general approach to developing MTAs, the actual 
processes followed for a given MTA varied over time, were ad hoc, and 
were not guided by interagency agreements or written procedures. As a 
result, the process for obtaining interagency input was inconsistent from 
2004 to 2010. He said that in those instances that DHS did not solicit 
interagency input through the workshops, DHS officials worked to obtain 
such input by contacting the interagency experts directly. He also said that 
DHS sometimes did not convene interagency workshops to reduce travel 
and other costs associated with holding these workshops in person. 

HHS officials described DHS's processes for developing MTAs as ad hoc 
and varied and said that they wanted more substantive and consistent 
coordination with DHS. HHS officials also told us that, in general, they had 
not been involved in key MTA development decisions. HHS uses the MTAs 
to help assess the medical and public health consequences of attacks with 
CBRN agents and determine the amount and type of countermeasures to 
develop and buy to respond to potential CBRN incidents. HHS officials 
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told us that their early and consistent involvement in the development of 
an MTA can affect how useful the MTA is to HHS for these decisions. HHS 
officials cited the development of the smallpox MTA, which DHS began 
developing in 2010 at HHS's request, as an example of improved 
coordination in which HHS was involved more substantively. For this 
MTA, DHS officials said they consulted with HHS on the development of 
the MTA prior to its development and are engaged in ongoing discussions 
with HHS throughout the development process. 20 However, HHS officials 
told us that this modified process was also an ad hoc effort that has only 
been used to develop the smallpox MTA, and they had no assurance that 
DHS would necessarily use this process for developing future MTAs. 

DHS does not have interagency agreements or written procedures to 
define the process for how the MTAs should be developed with its 
interagency partners, the products that should be produced, or the roles 
and responsibilities of involved agencies. Not having this documentation is 
not consistent with our best practices for interagency collaboration and 
federal standards for internal control. DHS officials said they plan to 
develop them by June 2012. DHS tried to develop an interagency 
agreement related to MTA development in 2008. Specifically, DHS drafted 
an MOU for DHS and HHS for issuing statements related to particular 
CBRN agents that pose a material threat to the nation based on MTA 
results. HHS officials said they did not sign the draft MOU, which was sent 
to HHS in July 2008, because they disagreed with some of its principles. 
For example, HHS officials expressed concern about their level of 
involvement in providing input into the assumptions and data used to 
develop the MTAs. In January 2011, DHS considered renewing its effort to 
have a revised MOU signed by HHS. However, DHS and HHS officials told 
us that these efforts were superseded by their ongoing discussions related 
to DHS's proposed strategic and implementation plans. As of May 2011, 
HHS officials told us that their concerns had not yet been resolved with 
DHS. 

By establishing interim time frames and milestones for developing and 
obtaining interagency agreement on its CBRN risk assessment efforts, 
DHS management could be better positioned to ensure that the 
department's proposed strategic and implementation plans are completed 
in the intended time frame. Such interim time frames and milestones could 



20 HHS officials said that as of May 2011, they had not reviewed the draft smallpox MTA 
because it had not yet been completed. 
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better ensure that DHS completes the strategic and implementation plans 
by June 2012 by, for example, allowing DHS senior leadership to monitor 
the department's progress on meeting interim time frames for achieving 
milestones for completion of these plans. DHS officials told us that these 
strategic and implementation plans will help ensure that DHS and its 
interagency partners achieve agreement on TRA and MTA interagency 
development processes and outcomes and agency roles and 
responsibilities, as well as establish DHS's and its partners' commitment to 
work collaboratively on these risk assessments. The proposed strategic 
and implementation plans could better ensure that future interagency 
coordination for the development of the TRAs and MTAs does not depend 
solely on personal relationships among officials from DHS and its federal 
partners, but is instead institutionalized at the department and continues 
beyond the tenure of any given official. In addition, as new interagency 
officials join the TRA working groups or MTA workshops, the proposed 
plans could better ensure that these new officials understand DHS's CBRN 
risk assessment development and review processes, the status of current 
TRA or MTA development, and their respective roles and responsibilities 
for these efforts. 



HHS has signed an interagency agreement with DHS and other federal 
partners to develop public health and medical consequence modeling 
reports but does not have written procedures that specifically outline how 
HHS and its federal partners, including DHS, are to develop and review 
these modeling reports. In 2008, HHS signed an MOU and working group 
charters with its PHEMCE partners — including DHS, the Department of 
Defense, and others — which support interagency coordination for 
PHEMCE activities, including developing public health and medical 
consequence modeling reports, among other activities. 21 Together, the 
PHEMCE MOU and working group charters — which stipulate the overall 
responsibilities and minimum meeting frequencies of the interagency 
working groups — are consistent with best practices for collaboration and 
generally serve to enhance and sustain agency collaboration by defining 
common outcomes and providing interagency agreement on roles and 
responsibilities as called for in our previous work. 22 However, the MOU 
and charters do not delineate how PHEMCE partners are to conduct 



The PHEMCE MOU and charters support interagency coordination between HHS, the 
Department of Defense, and the Department of Veterans Affairs, in addition to DHS. 

22 GAO-06-15. 



HHS Signed an Interagency 
Agreement and 
Coordinates with DHS to 
Develop Modeling Reports 
but Does Not Have Written 
Procedures for Their 
Development 
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medical consequence modeling, develop reports, and usher them through 
the interagency review process. 23 Not having this documentation is not 
consistent with federal standards for internal control, which call for 
agencies to develop written policies and procedures that enforce 
management's directives. 24 

From 2004 through 2006, the Executive Office of the President led 
interagency coordination efforts to assess public health and medical 
consequences, develop CBRN modeling reports, and establish medical 
countermeasure requirements. In 2006, HHS began leading the assessment 
of public health and medical consequences of CBRN agents and setting 
strategies for developing and acquiring medical countermeasures through 
the interagency PHEMCE. According to HHS officials, the PHEMCE 
working groups provide HHS officials with a structure for coordinating 
and obtaining interagency input on the modeling reports, among other 
activities. For example, HHS officials told us that within the PHEMCE 
working groups, interagency participants discuss any assumptions 
inherent in data about the agent or in planned responses to attacks 
outlined in the MTA scenarios and the range of variables and their 
parameters to make informed decisions on the inputs used to develop the 
modeling reports. HHS officials told us that the contractors and HHS staff 
who run the mathematical models for the modeling reports also 
participate in all PHEMCE working group meetings. 

As part of assessing public health and medical consequences and 
developing the modeling reports, PHEMCE working group members 
assess and discuss each section of the modeling reports, including the 
background information about the agent and the availability of medical 
countermeasures. Although the PHEMCE MOU and charters do not 
contain specific procedures for how PHEMCE partners are to develop the 
modeling reports, they help ensure overall coordination with DHS and 
other federal partners for PHEMCE activities. The Assistant Secretary for 
Preparedness and Response noted that collaboration with DHS has 
improved greatly over the past several years under the PHEMCE structure. 
In addition, DHS officials told us that they regularly attend PHEMCE 
meetings and are satisfied with the level of coordination. However, HHS 



23 According to HHS officials, the modeling reports are not intended to be end products but 
rather one step in the process of determining medical countermeasure needs in the event 
of an attack with a CBRN agent. 

24 GAO/AIMD-00-2 1.3.1. 
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officials noted that there are only a limited number of experts within 
PHEMCE and the federal government who have worked with CBRN 
agents or with individuals infected with these agents. They added that 
bringing all of these experts together to provide input on the modeling 
reports and other PHEMCE activities can be challenging because these 
experts often have competing responsibilities. 

According to HHS officials, the department did not develop written 
procedures for the development of modeling reports because the 
processes for conducting medical consequence modeling and developing 
the reports are constantly evolving and improving. For example, officials 
stated that more recent reports incorporate more factors and information 
than earlier versions. In addition, HHS officials told us that they do not 
have guidance or templates for the modeling reports because each CBRN 
agent is unique in the way it is transmitted and causes illness or injury and 
may not fit into a predetermined template. However, written procedures 
for the development and review of the modeling reports could provide 
HHS with standardized direction for obtaining, evaluating, and 
incorporating interagency input on these reports, while still allowing HHS 
to improve the modeling reports based on new scientific factors or 
information or new modeling techniques, or to tailor the reports to the 
characteristics of specific agents or types of agents. Furthermore, written 
procedures could also better ensure that future interagency coordination 
for the development of the modeling reports does not depend on personal 
relationships between officials from HHS, DHS, and other federal 
agencies. Written procedures could also help ensure that PHEMCE 
participants approach the development and review of each report 
consistently. In addition, as new interagency officials join the PHEMCE 
working groups, written procedures could help these new officials better 
understand PHEMCE's processes for assessing public health 
consequences and conducting modeling, the status of current modeling 
report development, and their respective roles and responsibilities in this 
effort. 

The 2008 MOU is set to expire in June 2011. According to HHS, the 
structure, membership, and roles of some PHEMCE participants has 
changed. For example, PHEMCE now includes officials from the 
Department of Agriculture, while participants from the Executive Office of 
the President no longer participate at the senior council level. HHS is 
currently revising the PHEMCE senior council charter to reflect the new 
structure and will include clarification of roles and responsibilities of the 
PHEMCE senior council. HHS officials told us they will determine whether 
to renew the MOU once they revise the senior council charter. Best 
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practices for collaboration suggest that federal agencies engaged in 
interagency coordination can enhance and sustain their collaboration by 
articulating these practices in written agreements, such as MOUs. It is not 
clear whether the revised senior council charter will define and articulate 
common outcomes or establish compatible policies and procedures for 
operating across agency boundaries. Revising the charter to include this 
information, or renewing the PHEMCE MOU and updating it to reflect 
current membership if it does not, could help demonstrate the 
commitment of all participating federal departments to working 
collaboratively and helping to ensure sustained interagency coordination 
for the development of modeling reports and other PHEMCE activities. 



In order to prepare for and respond to potentially catastrophic attacks 
with CBRN agents, effective assessment of the risks posed by these agents 
to national security and public health requires successful and sustained 
coordination and collaboration between DHS, HHS, and other responsible 
federal departments and agencies. DHS and HHS have been developing 
CBRN risk assessments— DHS's TRAs and MTAs and HHS's medical 
consequence modeling reports — since 2004, and their processes for 
coordinating risk assessment development have evolved over the past 7 
years but have not been fully institutionalized in writing. Developing 
written agreements could help DHS and HHS reach concurrence on 
procedures acceptable to both departments on their expected levels of 
involvement in developing their respective risk assessments. Given the 
additional value incorporated into the CBRN risk assessments from DHS 
and HHS working collaboratively to harness all available expertise, DHS 
and HHS could enhance their risk assessment processes by establishing 
written procedures for developing and reviewing these assessments. 
Establishing written procedures also includes updating existing 
interagency agreements, such as the PHEMCE MOU, or determining 
whether other agreements HHS is developing may be sufficient. Written 
procedures would provide direction for interagency coordination. In 
addition, interagency agreements could help ensure that sustained 
coordination continues beyond the tenure of any given agency official, 
enabling future officials to know their respective roles and 
responsibilities. While DHS intends to develop such procedures by June 
2012 in collaboration with its partners, establishing interim time frames 
and milestones for developing the strategic and implementation plans 
could allow DHS senior leadership to monitor departmental progress to 
better ensure completion of these efforts to institutionalize interagency 
coordination. 
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To ensure that DHS senior officials are able to monitor progress on the 
development of the proposed strategic and implementation plans for 
DHS's CBRN risk assessment efforts, we recommend that the Secretary of 
Homeland Security develop and document interim time frames and 
milestones as part of a plan to develop, finalize, and obtain interagency 
agreement on the written procedures for interagency development of the 
TRAs and MTAs that DHS intends to issue as strategic and implementation 
plans. 

To ensure that HHS and its federal partners are fully aware of and agree 
with the processes for developing the public health and medical 
consequence modeling reports and that consistent and effective 
interagency coordination continues, we recommend that the Secretary of 
Health and Human Services take the following two actions: 

• develop written procedures for obtaining, evaluating, and incorporating 
interagency input into the development and review of the modeling 
reports, to supplement the PHEMCE MOU and working group charters, 
and 

• determine whether to renew the MOU or whether alternate coordination 
mechanisms, such as the PHEMCE senior council charter, are sufficient to 
confirm federal departments' agreement to work collaboratively. 



We provided a draft of this report to DHS and HHS for their review. Both 
departments provided written comments, which are summarized below 
and reprinted in appendixes II and III, respectively. The departments also 
provided technical comments, which we incorporated where appropriate. 

DHS concurred with, and HHS generally agreed with, the basis for the 
recommendations and discussed actions planned or under way to address 
them. With regard to the first recommendation, DHS stated that the 
department has begun efforts to develop milestones and time frames for 
its strategic and implementation plans for interagency TRA and MTA 
development. In addition, DHS stated that enhanced coordination with 
HHS and its other federal partners for the development of the TRAs and 
MTAs was important, especially as the MTAs support HHS's medical 
countermeasure decision making. 

With regard to the second recommendation, HHS stated that it 
conceptually agreed that institutionalizing agreements and procedures for 
the development of the modeling reports in writing is important. However, 
HHS expressed concern that the report implies that HHS does not vet its 
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products through PHEMCE partners, including its modeling reports. We 
disagree. The report states, for example, that PHEMCE provides a means 
for HHS to coordinate and obtain interagency input on modeling reports, 
among other activities. With regard to the third recommendation, HHS 
stated that it concurs and had taken action to renew the PHEMCE 
interagency MOU. 

HHS also commented that our use of the term "risk" is not consistent with 
DHS's and HHS's use of this term. DHS defines risk as the potential for an 
adverse outcome assessed as a function of threats, vulnerabilities, and 
consequences and risk assessment as a process to assign probabilities to 
such outcomes. HHS pointed out that while DHS's MTAs assess threat, 
they do not include an assessment of the probability that a particular agent 
will be used. We recognize that the MTAs and HHS's medical consequence 
modeling reports do not individually contain all three elements of threat, 
vulnerability, and consequence and an assessment of probability that 
make up DHS's definition of risk. However, for the purposes of this report 
we consider both the MTAs and the modeling reports to be CBRN risk 
assessments. The MTAs contain assessments of threat and vulnerability, 
and modeling reports contain assessments of consequence and 
vulnerability based on the MTAs. These two types of assessments, along 
with DHS's TRAs, provide measurements of risk consistent with the 
departments' use of the term. We modified the language in the report to 
appropriately clarify the use of this term. 

Finally, HHS stated that the report's focus on HHS's modeling reports 
creates an inaccurate perception of these documents as end products. This 
was not our intention. Specifically, the report states that these documents 
are not intended by HHS to be end products and represent an interim step 
of assessing potential public health and medical consequences and 
determining what types and quantities of medical countermeasures HHS 
may need to respond to a CBRN event. However, to address HHS's 
concerns, we modified text in appendix I discussing the modeling reports 
to clarify that these are interim products. 



We are sending copies of this report to the Secretary of Homeland 
Security, the Secretary of Health and Human Services, and interested 
congressional committees. The report is also available at no charge on the 
GAO Web site at http://www.gao.gov. If you or your staffs have any 
questions about this report, please contact William O. Jenkins, Jr. at (202) 
512-8777 orjenkinswo@gao.gov or Marcia Crosse at (202) 512-7114 or 
crossem@gao.gov. Contact points for our Offices of Congressional 
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Relations and Public Affairs may be found on the last page of this report. 
Key contributors to this report are listed in appendix IV. 



William 0. Jenkins, Jr. 

Director, Homeland Security and Justice 




Marcia Crosse 
Director, Health Care 
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Appendix I: DHS and HHS Chemical, 
Biological, Radiological, and Nuclear Risk 
Assessments 



In response to provisions in the Project BioShield Act of 2004 1 and 
Homeland Security Presidential Directives (HSPD) 10 (Biodefense for the 
21st Century), 18 (Medical Countermeasures against Weapons of Mass 
Destruction), and 22 (National Domestic Chemical Defense), the 
Department of Homeland Security (DHS) and the Department of Health 
and Human Services (HHS) develop three types of chemical, biological, 
radiological, and nuclear (CBRN) risk assessments — DHS's terrorism risk 
assessments (TRA) and material threat assessments (MTA) and HHS's 
public health and medical consequence modeling reports. 



Risk and Risk 
Assessment 



The DHS Risk Lexicon defines risk as the potential for an adverse 
outcome assessed as a function of threats, vulnerabilities, and 
consequences associated with an incident, event, or occurrence. 2 Threats 
are defined as entities, actions, or natural or man-made occurrences that 
have or indicate the potential to harm life, information, operations, or 
property. Vulnerabilities are defined as the physical features or 
operational attributes that render an entity, asset, system, network, or 
geographic area susceptible or exposed to hazards. Consequences are 
defined as the potential or actual effects of an event, incident, or 
occurrence. The DHS Risk Lexicon defines risk assessment as the product 
or process that collects information and assigns values to risks for the 
purpose of informing priorities, developing or comparing courses of 
action, and informing decision making. According to DHS, risk 
information is usually one of many factors — and not necessarily the sole 
factor — that decision makers consider when deciding which strategy to 
pursue to manage risk. 



DHS and HHS CBRN 
Risk Assessments 



DHS Terrorism Risk 
Assessments 



In response to provisions in HSPD-10, HSPD-18, and HSPD-22, DHS 
conducts CBRN risk assessments and coordinates with appropriate 
subject matter experts, including those in HHS, in developing these risk 



'42 U.S.C. § 247d-6b(c)(2)(A), (B). 

2 DHS, DHS Risk Lexicon: 2010 Edition (Washington, D.C., September 2010). Developed 
by DHS's intradepartmental Risk Steering Committee, the purpose of the DHS Risk 
Lexicon is to establish and make available a comprehensive list of terms and meanings 
relevant to the practice of homeland security risk management and analysis. 
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Appendix I: DHS and HHS Chemical, 
Biological, Radiological, and Nuclear Risk 
Assessments 



assessments. DHS has issued seven classified TRAs to date, and one is 
currently in development. DHS issued three successive biological TRAs 
(BTRA) in 2006, 2008, and 2010; two chemical TRAs (CTRA) in 2008 and 
2010; and two integrated CBRN TRAs (ITRA) in 2008 and 2011. 3 In 
addition, DHS also plans to issue the first radiological and nuclear TRA 
(R/NTRA) in 2011. The results of the individual BTRAs, CTRAs, and 
R/NTRAs are combined to develop the comprehensive ITRAs. 4 Each TRA 
assesses the relative risks posed by multiple CBRN agents based on 
variable threats, vulnerabilities, and consequences. DHS updated these 
TRAs biennially in the past, and DHS officials said that they plan to update 
them quadrennially going forward, in part to reflect current terrorism 
event probabilities and accurately determine relative CBRN terrorism risk. 
TRA results are based on risk modeling that assesses the likelihood of a 
terrorist attack using a CBRN agent, combined with the consequences that 
would result from a successful attack. Modeling of the likelihood of an 
attack is based on an assessment of the actions that an adversary, such as 
a terrorist, is determined to be likely to pursue — based in part on 
intelligence community inputs — combined with an assessment of the 
vulnerability of U.S. population centers to such an attack. DHS uses risk 
modeling techniques and computer software to calculate TRA results 
based on millions of hypothetical CBRN terrorism attack scenarios that 
include variable likelihood figures and consequence parameters. 



DHS Material Threat Under the Project BioShield Act of 2004, DHS is required, on an ongoing 

Assessments basis, to assess the threat posed by specific CBRN agents and to issue 

determinations for those CBRN agents that pose a material threat to the 
U.S. population sufficient to affect national security. 5 In response to these 
requirements, DHS has issued 17 classified MTAs to date, each of which 
assesses the threat posed by a given CBRN agent or class of agents and the 
potential numbers of human exposures in plausible, high-consequence 



3 DHS was originally scheduled to issue the second ITRA in 2010. However, DHS published 
it in 2011 and plans to issue future iterations quadrennially thereafter (e.g., 2015, 2019, etc.) 
so that the ITRA, which relies on data contained in the BTRA, CTRA, and radiological and 
nuclear TRA (R/NTRA), will be produced in the years following publication of these other 
assessments. The next iterations of the BTRA, CTRA, and R/NTRA are scheduled for 2014. 

4 The 2008 ITRA was developed based on the results of the 2008 BTRA and CTRA, as well as 
a radiological and nuclear appendix to the 2008 ITRA report. The 2011 R/NTRA is the first 
standalone R/NTRA to be produced, and its results will be combined with those from the 
2010 BTRA and CTRA to develop the 2011 ITRA. 

5 42 U.S.C. § 247d-6b(c)(2)(A). 
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Appendix I: DHS and HHS Chemical, 
Biological, Radiological, and Nuclear Risk 
Assessments 



scenarios. 6 DHS solicits intelligence community officials to define and 
articulate the plausible, high-consequence attack scenarios that might be 
pursued by terrorists seeking to maximize casualties. These scenarios are 
then analyzed to determine the results of an MTA to provide an estimate of 
the number of people exposed to different dose levels of an agent in the 
scenario. HHS uses the MTAs to inform medical consequence modeling to 
support defining requirements for medical countermeasures to mitigate 
the health effects of CBRN agents. 



HHS Public Health and 
Medical Consequence 
Modeling Reports 



The Project BioShield Act of 2004 calls for HHS to assess the public health 
consequences of exposure to those CBRN agents that DHS determines are 
material threats to the nation. 7 In response, HHS has issued 19 modeling 
reports for CBRN agents, using the data from the corresponding DHS MTA 
to calculate the number of individuals who may become ill, be 
hospitalized, or die based on the MTA scenario. To develop these 
estimates from the MTAs, HHS consults with experts and uses available 
scientific data, such as data on how much of an agent is needed to cause 
infection and how long it takes to develop symptoms of disease after 
exposure. In addition, HHS assesses the status of current countermeasure 
development and availability, including applicable countermeasures that 
the Department of Defense may be developing. HHS uses the modeling 
reports as an interim step to help assess public health and medical 
consequences and determine which medical countermeasures are needed, 
and in what quantity, and the optimal timing for treating the affected 
population following an attack. 8 



Since 2004, DHS determined that 14 of 17 CBRN agents that it assessed in MTAs pose a 
material threat to the nation and issued material threat determinations for those agents. 
The 14 material threat determinations that DHS has issued to date are for Bacillus 
anthracis (anthrax), Burkholderia mallei (glanders), Burkholderia pseudomallei 
(melioidosis), Clostridium botulinum (botulism toxin), Ebola virus (hemorrhagic fever), 
Francisella tularensis (tularemia), Junin virus (hemorrhagic fever), Marburg virus 
(hemorrhagic fever), multidrug-resistant Bacillus anthracis (MDR anthrax), Rickettsia 
prowazekii (typhus), Variola major (smallpox), Yersinia pestis (plague), radiological 
agents, and nuclear agents. 

7 42 U.S.C. § 247d-6b(c)(2)(B). 

8 Medical countermeasures include drugs, biologic products, and devices to identify, treat, 
prevent, or mitigate potential health effects from exposure to CBRN agents. HHS acquires 
CBRN medical countermeasures to treat the potentially exposed population after an attack 
in order to prevent the onset of disease as well as to treat individuals who have developed 
disease resulting from such an attack. 
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HHS modeling reports assess factors that may affect the number of 
individuals who may be infected with a given CBRN agent — such as the 
quantity of the agent released, the timing of the release, environmental 
conditions, population demographics, and the timing of medical 
countermeasure administration, among others — and may include multiple 
exposure scenarios as appropriate. For example, depending upon the 
agent, some modeling reports may account for differences in height, 
weight, and lung function among individuals of different genders and ages 
to model short- and long-term health effects for these populations because 
the course of disease caused by an agent can differ based on these 
characteristics. Other modeling reports may evaluate multiple exposure 
scenarios — such as inhalation of or skin contact with an agent — to 
determine the numbers of potentially infected individuals. 

Modeling reports may also evaluate potential health consequences 
resulting from different response strategies based on the time it takes to 
detect an attack by environmental sampling or by individuals presenting at 
hospitals, initiate a medical countermeasure prophylaxis campaign, and 
distribute and dispense medical countermeasures to the affected area and 
individuals. Modeling report results include analyses of the range of 
individuals who may die without treatment with medical countermeasures 
and optimal time frames for providing medical countermeasures to 
prevent significant numbers of deaths from infection with an agent. 
Modeling reports also identify gaps in knowledge, such as limited 
scientific information about the response of a particular CBRN agent to a 
countermeasure, and the extent to which HHS assesses short- and long- 
term medical countermeasures needs as a result of exposure to an agent. 
(See table 1 for the HHS modeling reports developed to date.) 
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Table 1 : Diseases and Agents for Which HHS Has Developed Medical and Public 
Health Consequence Modeling Reports 



Biological 


Chemical 


Radiological and nuclear 


Anthrax 8 


Blood agents 


Improvised nuclear 


Botulism 


Low volatility nerve 


device 


Glanders and 


agents 


Radiological dispersal 


melioidosis 


Pulmonary agents 


device 


(Burkholderia) 


Vesicants 




Junin virus 


Volatile nerve agents 





Marburg virus" 
Plague 

Q fever, Rocky Mountain 



spotted fever, and 
typhus (Rickettsia) 

Smallpox 

Tularemia 

Source: HHS. 

"HHS has issued four separate modeling reports for anthrax to examine particular issues in addition 
to countermeasure needs, such as countermeasure cost and effectiveness and different strategies for 
using anthrax vaccine. 

"The Marburg modeling report includes considerations for Ebola virus. 
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of Homeland Security 



U.S. Department of Homeland Security 
Washington, DC 20528 




Homeland 
Security 



June 8, 201 1 



William O. Jenkins 

Director, Homeland Security and Justice 
U.S. Government Accountability Office 
441 G. Street NW 
Washington, DC 20548 

Re: Draft Report GAO-1 1-606, "NATIONAL PREPAREDNESS: DHS and HHS Can 

Further Strengthen Coordination for Chemical, Biological, Radiological, and Nuclear 
Risk Assessments" 

Dear Mr. Jenkins: 

Thank you for the opportunity to review and comment on this draft report. The U.S. Department 
of Homeland Security (DHS) appreciates the U.S. Government Accountability Office's (GAO's) 
work in planning and conducting its review and issuing this report. 

The Department is pleased to note the report recognizes that DHS, the U.S. Department of 
Health and Human Services (HHS), and other key federal partners have been coordinating and 
developing Chemical, Biological, Radiological, and Nuclear (CBRN) risk assessments since 
2004. These assessments are critical to supporting the Nation's CBRN preparedness and 
defense-related activities, including investments for prevention, protection, surveillance, 
detection, response, and recovery. 

DHS is fully committed to supporting the National CBRN Defense Strategies and all our federal 
partners to ensure key risk assessments are conducted in a collaborative and coordinated manner 
to yield quality products. These assessments are based on current, available science and 
knowledge and our best judgments to understand the risks inherent in CBRN agents. The 
inevitable degree of uncertainty associated with understanding these agents and their use is also a 
contributing factor. As such, it is critical for our federal, state, local, and tribal partners to utilize 
these assessments with the understanding of the assessments' intended uses, applications, and 
limitations when making decisions. 
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The draft report contained one recommendation directed to DHS. Specifically, to ensure that 
DHS senior officials are able to monitor progress on the development of the proposed strategic 
and implementation plans for DHS's CBRN risk assessment efforts, GAO recommended that the 
Secretary of Homeland Security: 

Recommendation: Develop and document interim time frames and milestones as part of a plan 
to develop, finalize, and obtain interagency agreement on the written procedures for interagency 
development of the TRAs and MTAs that DHS intends to issue as strategic and implementation 
plans. 

Response: Concur. DHS agrees that the collaboration and coordination between DHS and HHS 
for conducting the CBRN risk assessments - terrorist risk assessments (TRAs) and material 
threat assessments (MTAs) can be enhanced and strengthened. For example, the MTAs 
encompass population exposure modeling for consensus scenarios and support HHS's public 
health modeling and medical countermeasures requirements development efforts resulting in the 
issuance of Material Threat Determinations to facilitate better preparations for and responses to 
potentially catastrophic attacks with CBRN agents. DHS has initiated efforts to map out the 
timeline and milestones to ensure timely development of a Strategic Implementation Plan for 
conducting these critically important assessments. 

Again, thank you for the opportunity to review and comment on this draft report Sensitivity 
comments have been submitted under separate cover. We look forward to working with you on 
future Homeland Security issues. 



Sincerely, 



JinJ H. Crumpackfr"^"^* — ' 
Director 

Departmental GAO/OIG Liaison Office 
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DEPARTMENT OF HEALTH « HUMAN SERVICES 



Assistant Secretary for Legislation 
Washington, DC 20201 



OFFICE OF THE SECRETARY 



Marcia Crosse 



JUN 3 2011 



Director, Health Care 
William O. Jenkins 

Director, Homeland Security and Justice 
U.S. Government Accountability Office 
441 G Street N.W. 
Washington, DC 20548 



Dear Ms. Crosse and Mr. Jenkins: 

Attached are comments on the U.S. Government Accountability Office's (GAO) draft report 
entitled: "NATIONAL PREPAREDNESS: DHS and HHS Can Further Strengthen 
Coordination for Chemical, Biological, Radiological, and Nuclear Risk Assessments" (GAO-1 1 - 
606). 

The Department appreciates the opportunity to review this report before its publication. 



Sincerely, 




Jim R. Esquea 

Assistant Secretary for Legislation 
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Appendix III: Comments from the Department 
of Health and Human Services 



GENERAL COMMENTS OF THE DEPARTMENT OF HEALTH AND HUMAN 
SERVICES (HHS) ON THE GOVERNMENT ACCOUNTABILITY OFFICE'S (GAP) 
DRAFT REPORT ENTITLED, "NATIONAL PREPAREDNESS: DHS AND HHS CAN 
FURTHER STRENGTHEN COORDINATION FOR CHEMICAL. BIOLOGICAL. 
RADIOLOGICAL. AND NUCLEAR RISK ASSESSMENTS" (GAO-1 1-6061 



The Department appreciates the opportunity to review and comment on this draft report. 

Throughout this report, GAO's use of the term "risk" is not consistent with its use by HHS and 
the Department of Homeland Security (DHS). For example, a material threat assessment (MTA) 
evaluates threat, which is a component of risk, but not risk, because it does not include an 
assessment of the probability or likelihood of a particular agent being used. We have raised this 
issue with GAO previously and the response has been that GAO prefers to use the term "risk" in a 
more generic way. Nevertheless, the Department wants to make official note of this concern. 

Similarly, throughout this draft report there is a focus on the consequence modeling reports as if 
they are the end product of the Public Health Emergency Medical Countermeasures Enterprise 
(PHEMCE) working groups. This is not an accurate assessment. The modeling report feeds into 
the consequence assessment process within the working groups that develop the scenario-based 
requirements (SBRs) that discuss the agent, the disease characteristics, the types of consequences, 
the number of injuries by types, and other factors. The PHEMCE working group members 
develop SBRs for delivery, not modeling reports. The modeling is one input and documentation 
to support the SBRs and product-specific requirements (PSRs). GAO's focus on the modeling 
reports as representative of the medical consequence assessment and not including discussion of 
the SBR development process can be misleading as it does not accurately describe the entire 
process. 

Conceptually, we agree with GAO's emphasis in this report on memorializing agreements and 
institutionalizing best practices for development of the terrorism risk assessments (TRAs), MTAs, 
and consequence modeling reports in written documents, and the report makes many useful 
observations about current deficiencies in this regard. However, we are concerned that the 
language used in this report implies that HHS does not vet the PHEMCE work products 
(including modeling reports, SBRs, and PSRs), when in actuality there is a transparent process, 
albeit one that is not documented in a charter. 

HHS concurs with GAO that the PHEMCE interagency memorandum of understanding (MOU), 
which expires in June 201 1, demonstrates the commitment of all participating federal departments 
to work collaboratively on PHEMCE issues. For this reason, HHS has undertaken efforts to 
renew this MOU with its interagency partners. 
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